Behind the Shield: Securing SMBs with CyberFox’s David Bellini

Hey everyone. Welcome back here to Techstrong tv. I've got a, a new guest to introduce you to a new company.

I'm excited by it. Let me introduce you all to David Bellini. David is the CEO and co-founder of a company called Cyber Fox.

David, welcome to Tech Drunk tv. It's great to have you on. Hi.

Thanks for having me on. Pleasure. So, David, before we jump into Cyber Fox and we're gonna talk DNS filtering and stuff like that, I wanted to give our listeners a sense of who they're listening to.

So if you don't mind, I, I mentioned your CEO and co-founder at Cyber Fox, but give us, give us kinda your journey. Yeah, okay. I mean, I started out, wow, uh, we, my brother and I claimed to have the very first I-D-M-P-C XT in Tampa.

Uh, dad worked for IBM, so we were probably a couple, you know, we were first on the list or close to first on the list. Uh, and so we just started playing around with PCs early on. Yeah.

And so we started, uh, a IT service practice early on, selling IBM PCs and compatibles. So we've been in the business a long, long time. Uh, and from there we spun up a co, a company called ConnectWise, which was, uh, you know how you manage all these little IT service organizations throughout the world?

Unbeknownst to us, there's like a hundred thousand of them. So we, yeah, we built up ConnectWise, uh, and, and we did sell that in 2019. Um, I was retired for about three years, and I got really, really bored, uh, first 18 months.

Wonderful. Any of you people trying to retire out there, you'll love it, but I'm telling you, then it gets really boring. And so I had to get back in the game and, and, um, I love that.

Yeah, You have to, well, yes, you have to get back in the game because to get, for someone like me, it just got too boring trying to be on charity boards and things like that. So, uh, I started this cybersecurity, which wasn't, you know, I was just mentioning earlier, you know, cybersecurity back in the nineties was not a big deal. We had, we had this wide open internet that created all this efficiency.

And I like to think of it as, um, you know, the knowledge worker of the nineties we're doing three x their work, uh, today because of, you know, because of our iPhone, because of the internet, because of all these advances that we have. And I think AI's gonna in even increase that. So the good news is we had the, I, we pretty much had the internet to itself for about 30 years.

And then the bad guys have started coming in, creating a lot of havoc on, you know, ransomware and, you know, just nation states just attacking different things to create chaos and things like that. So cybersecurity has become a much, much bigger deal in this last decade, especially since COVID, I think it really created a lot of, uh, you know, weaknesses. It expanded the digital landscape.

So there's a lot more openings to, you know, uh, make companies more vulnerable. But I've been really hanging with the, the small, medium sized businesses. That's been my journey.

I've been a small, small, medium sized business owner forever. Uh, so, uh, my, my passion is really to help that group of people get secure. Uh, and I think that they, they're really, uh, unprotected compared to the Fortune 500.

And so it's important for us to build products to help them out. Yeah, they're definitely an underserved market. You know, I don't know if you realize, so our offices right here are in Boca Raton right down the road.

Okay. From what they call the brick. The brick is the old IBM facility where they, where they built the PCs, where they just not built, but where they designed.

Yeah, I remember pc. Yep. Yep.

Right. So I'm sure your dad might have been down here a whole bunch of times back in those days with a guy named Don Estridge who was heading up the IBM. He headed up the IBM PC program, uh, yeah.

Based down here. And unfortunately he died in a plane crash. They have a, like a school named for him here.

But, um, you know, there's a lot of connections back to those days right here in Boca. They, they're actually redeveloping the brick now to make it more of a mixed use thing, but they still have the room where Bill Gates Yes. Signed the dos uh, licensing agreement.

That's right. And if you wanna do a, if you're a red, if you're a tenant there and you want to do a, a, uh, press conference or something, you could use that room. There's like a plaque commemorating.

It's very cool. Anyway, you know, David, I, I have been in security for 30 years plus years, and, um, you are right. We, we went from an era of kind of Matthew Broderick, you know, kitty Scripps, right?

You wanna play thermonuclear war to two Security is big, or, or hacking is big business, financial gain, nation state espionage and strategic kind of kind of things. Hacktivism, terrorism, you know, all the isms if you will. Um, and, and with that, security's become, you know, top of, top of mind for people.

And, and then you also have, I, and you alluded to it, you know, what we call the security attack surface, right? Between AI and all the data and everything, and our phones and our computers and all these devices that are connected to the internet, IOT and so forth. The attack surface of what we have to defend is exponentially bigger.

Yes. So the mission has grown with it. Right.

And, and yes. And I, that's, I think, you know, the world, unfortunately, it's why we can't have nice things. It's the world we live in.

Right? That's right. There's, there's bad evil.

There's always bad actors out there. And I think, like you mentioned, I think part of the problem is on the dark net. I mean, it's a whole cottage industry out there selling, hacking tools, you know, so if you, you know, unfortunately you have young males that, you know, I said males that shouldn't pick on them, but it's typically younger men that are in the basement's.

That's who it is. Let's fix it. You're right.

Yeah. Um, you don't see a lot of women hackers though. They're out there too.

They, this, you know, this crosses over, but I get it. But they're, But they're, you know, young 18 year olds sitting in their basement. Two of them might be sitting in the, their basement in Brazil, one is in the UK and they've created a little hacking gang.

Uh, you know, they bought these, these tools on the dark net and they go to town, they just breach people for 10 grand each. They go, they just go hit SMB. It's embarrassing for me and my company to get hit.

So I, instead of making a newsworthy thing by calling the FB, I just pay it. Uh, so yeah, I, and they're just going right along, you know, making $10,000 hits. So it's coming downstream to us.

It's no longer the Fortune 500 and you're starting to see it, you know, and I'm, uh, I still own an MSP actually, uh, I still own MSP that's 45 years old now. And, uh, you know, I know that last year we had, uh, one of our companies that, one of our customers there got breached. You know, they had stopped, they had stopped using our services except for our data Datto backup.

And thank god the Datto backup was there to save the day. But I mean, you have to have, you know, what, what we used to have is four, you know, maybe we have a firewall, uh, antivirus, uh, spam filter. Well, now you have to have about 21 different things to start kinda keeping traction.

I think that's the complication One. The average. The average, the average organization has 70 something different security programs is the latest research we've seen.

Think about that for an smb, and I'm not, look, there are SMBs mom and pop shops, and then there are sort of, let's call 'em small medium enterprises, you know? 'cause generally SMB is up to, depending who you talk to, a thousand employees, 500 employees. Right.

Those are, those are considered small businesses. Sure. You know, and, and here's the thing, a thousand person SMB if you're lucky, if you're lucky, has one full-time security person.

One. That's right. And it, a lot of times they don't even have a security person.

It's their it, you know, it's their Right. It's a, it's their Chief Executive Information Officer. That's, It's someone, someone else just wearing a second hat.

Right? Yeah. And, and so that, that is it.

And one other thing I just wanna mention, all these little gangs, you know, three kids, three not kids, three people here and there doing that ransomware, what you don't realize is a lot of times these people are getting radicalized, or not even radicalized, but unbeknownst to them, hooked into this broader network that we've seen over the last couple months. Some of them have been getting taken down, but they really have connections all the way back to the nation state. Yes.

Yeah. Well, they're funded, but they just, it, it's a way to fund the Bad guys. Yeah.

They don't realize that's where it's coming from. Yeah. Yeah.

They're terrorists. They, they don't even even know they're terrorists. Yeah.

They're, they don't even realize they're tools being used like that. Right. Yep.

Sure. Anyway, great story, great conversation. And I will mention, I'm assuming Arne's your brother then with the same last name.

Yeah. Yes. Yes.

Arne and I started, uh, ConnectWise together. So I did an interview with Arne, uh, I guess two, three weeks ago. It's on text Drunk tv, if you wanna find out what he's doing.

Also. Very interesting. Check it out there, David.

Let's talk Cyber Fox though. So you, you, you got your hand back in the game here, right? What's the mission?

Well, the mission really is, is to really help protect that small, medium sized business that's underprotected like you had mentioned earlier. And so we're building products. And the key on this is, you know, the, the big Fortune five hundreds can hire a CISO and they can hire a lot of people under there to run all these tools.

'cause these tools are complicated. And you need a full-time person to run all these tools to make sure everyone's secure. Well, SMB doesn't have that type of money, you know, so it's, we have to make the tools much simpler and much less expensive.

Okay. So that's the goal is to kind of, let's help protect them. And we have a, we have a, uh, saying 80% of the features for 90% of the discount.

You know, so we're gonna, we're gonna cover most of everything that the big guys are doing, and we're only gonna cost, you know, we're gonna be 90% of what their price is. And that works for SMB. Okay.

So, SMB, to be fair, uh, to ask someone to pay maybe $50 a month per employee for Security Stack, they can handle that. But if you're trying to tell 'em they're gonna have to pay $500 a month per employee, that's too expensive for s and b, they're, they're just gonna say, well, I, I can't do that. You know, Do without.

Yep. I'll do without, and I'll take my chances and cross my fingers. So what the, the goal is to really start kind of creating, and a lot of these products, you know, with the advent of the artificial intelligence and stuff like that, allows us to be a lot more efficient to do the job at less, much less price.

So, I mean, I think we're seeing that we actually are seeing some of the Fortune five hundreds come down and ask for our products because, you know, they, they might be, have budget constraints of their own, uh, and will actually use our products. We, we have a lot of, uh, sled, you know, government agencies that want to use it too. 'cause they're tight on budget, you know, so they'll come and they'll use some of our less expensive products and they, you know, they get covered.

And so Sure. It's working out well. We've had a good run at it.

Uh, we have a product called Auto Elevate, which is a permission access manager, which is really our flagship product that, uh, you know, we've sold to four, 4,000 MSPs already. So, and they've sold it to, you know, countless of their customers. So it's, uh, it's out there and having a lot of success.

So let me make sure I got this. Cyber Fox in and of itself is not a, what, what we call an MSSP, right. Managed Security service provider.

It, it, it creates products that you sell to that channel that are then using it, you know, to their customer base, to their managed customers. But you, but then you have other customers who are buying the software directly and men and using it in-house, so to speak. Yeah, yeah.

We, I mean, SMB is a pretty big market. I mean, I would say the MSP channel has about one third of the SMB they're supporting, but there's two thirds out there that, that won't use. An MSP doesn't even know what an MS P is.

You know, like all the governments, I mean, like all these little city municipalities, they, they don't use MSPs and they, I'm not sure if it's any reason they don't, but they'll have small IT departments that are under budget and need to protection. You know, they're not, uh, and, and we typically fit well with all those. So we sell to a lot of colleges, a lot of school systems, uh, things like that, that they have their own IT departments.

They'll have like 15, 20 person IT departments. And we have success, success, uh, selling to those folks as well. You Know, uh, I had started a company out in Boulder, Colorado back in 2001.

And very similar, we were concentrated on SMEs, right. Small medium enterprise. And we had intrusion prevention, vulnerability management, remediation, and network access control.

And then secure, uh, what, what became known as UTM, unified Threat Management. And very similar David, or excuse me. Yeah, it's David, very similar.

You know, we went after state, local government, uh, EDU, higher, you know, higher ed, and then the usual suspects, healthcare, finance, et cetera. Um, after about eight years of doing that, David, I realized that most of those customers just, even, even if I gave them the tools for free, frankly. Yeah, Yeah, Yeah.

They didn't have the wherewithal Yes. To run them. And so I went to the board and said, Hey, we need to become an MSSP.

And we, we bought, we bought an MSSP down here in South Florida, and we started offering that to our SME customers, you know, and, and then still selling product to the enterprise. But it really very quickly became two different companies or two different business lines. 'cause it, it, you know, there's a very big, there is a difference.

Yeah. Huge difference. But you're right, some of the smaller ones do seek to come down market because they don't have the wherewithal to run these monster That's right.

Security platforms. That's right. And there's a lot of them up there.

Yeah. There's a lot of 'em up there. Very comprehensive.

Uh, but SMB, I think the problem with SMB is so many of the knowledge, I call 'em knowledge workers today, uh, they wear multiple hats, you know, so sometimes they're the, the shipping managers, sometimes they're the accountants. So they're wearing all these different hats and there's all these different programs they're using. So they don't use the same three programs all day long.

They're using everything. And so I think from that standpoint, they're a little more harder to protect. 'cause they're using a lot more different products and they're doing a lot more roles.

So, and I think if you slow them down, that really, really makes 'em incompetent. And so it's important to create an environment where they can get their work done, but we also have to start supporting 'em. And, you know, we have to make sure they're secure so that they don't, you know, 100%, uh, uh, you know, uh, get breached.

But I, I always talk about zero trust. You know, people say, oh, we gotta get to zero trust. And, and I have an analogy where zero trust is, uh, if you had a house that was zero trust, it would've no doors, it would have no windows and have no ventilation.

You're pretty much gonna Suffocate inside. I mean, I used to people before, so, I mean, you've gotta have Openings. Yeah.

I used to tell you, you wanna be really secure, just unplugged from the Internet's, right? That's right. You may not not do any business, but you won't have to worry about that, David.

That That's right. I want to, well, actually, before I do, for people who want information about Cyber Fox, what's the website? com.

com. Yeah. Easy.

Just wanna make sure we get that in there. Yeah. Um, David, I wanna kind of pivot to, you guys just launched, throw a new DNS filtering service.

That's right. You know, just this week a good chunk of the internet was brought down if you hosted at AWS because they had a little DNS issue. So, you know, how, how timely that, what we're talking about this.

But That by the way, that, that brought down our phone systems, which are internet based, that brought down Hub HubSpot, which is, you know, where we keep, you know, all our information. Yeah. Just, you know, hey man, it that, that's, but it's all connected like that and that, you know, just takes one little thing.

Talk to us about your DNS filtering solution. Well, we had a, a, a large amount of, you know, we had four, 4,000, 5,000 different customers, and a lot of 'em have asked for it. They're saying, Hey, you know, what are you guys gonna do?

Do you have a DNI? We got a lot of, I think what's happened in DNS is it's, uh, a lot of the products that are out there have kind of become old and kind of, they haven't moved their, uh, innovation forward in years and years and years. Uh, and so I think from our standpoint, we're like, Hey, let's go ahead and refresh it and we'll bring out the new features that people need today.

So ours has a element of, you know, has an AI element to it where it's gonna go out and browse the first 20 pages of every website and determine, Hey, is this a dangerous site that they should go to or not? So that person might get to the site the first time, but then the AI will catch up and say, yeah, that you, you can't go back there. So, and, and then also we have the whole, you know, the curated list of all the bad places to go, and it's blocking people from that.

Uh, the other feature that's really different than everyone else is, um, so the good old IP addresses are kind of run out, you know, it's like we've had so many devices out on the internet that, uh, I think a lot of the phone systems, the digital carriers are starting to switch over to this, this IP V six, uh, which allows lar more addresses out there. So being able to do DNSL to on your phones and all your, or your, you know, handheld devices are important as well. And so we're protecting that.

And we have a feature that kind of actually takes care of that IP address range as well. So, you know, these are some of the updates that we've done. We've got a really good, uh, introductory now 25 cents an agent, um, that we have till the end of the year, which is very, very, very low compared to the, uh, competition.

So. Sure. Uh, but yeah, we're excited about it.

It's, um, it's something that we've been using internally for five months. So we've, we use ourselves as the alpha beta testers, and so it's working great for us. We got a lot of it out there, uh, uh, customers already and we're seem to say, have some good success with it.

Excellent, man. That, that's good stuff. Um, so we've got DNS filtering, just, you know, for our audience sake, what are some of the other areas of the other solutions?

You mentioned one. Yeah, we, we have the popular flagship product, um, is, uh, uh, auto Elevate, which is our, uh, permission access manager. And I only bring that if you've been in the MS.

P industry. Uh, we all turned on Microsoft Group policies about 20 years ago, and we all turned it off within 24 hours because it completely bricked all the computers. You know, it was like, okay, all the customers got mad and they couldn't get their work done.

So we all turned it off. It was a great idea. It was too, too cumbersome to work with.

So our product really kind of solves that problem where it's just in time elevations, we make the rules up as we go. And that's really what SMB needs is that kind of just in time thing. It's very, very easy to use.

You can install it in 15 minutes. So that product, we've, we've, we've got millions of agents out there right now, uh, running successfully, and it's been very, very good, good way to get everyone down to standard rights instead of just giving everyone local admin rights. And I think that's been a big problem in SMB is, hey, we don't wanna upset the customer, just give them all the access they need.

So they don't, they don't get mad at us. Yeah. So that one, uh, we have a password manager as well, uh, that, uh, you know, it's just, you gotta have a password manager if you wanna get any type of security compliance, SOC 2 compliance, whatever you're gonna get.

And I do believe all small, medium sized businesses will get, will have to become SOC 2 compliance in the next 10 years. I think it's gonna be forced on us all, you know, slowly but surely we've got to start protecting the, uh, you know, the whole supply chain. You know, so just because you're an SMB doesn't mean you, you know, you might be taking care of a vendor that's taking care of the US government in some way.

So you're part of the supply chain. You have to become secure to be part of that supply chain as time goes on. So it's gonna get slowly but surely will, uh, you know, be forced onto us just like HIPAA's everywhere now, you know, took a while to get us there, but It's, it's, it's, it, you know what, we've seen a lot of attacks where it was an SMB third party had act, had, you know, was able to interject something into the software supply chain of a major player, a Microsoft right.

Or, or you know, what have you. And, and all hell breaks loose, right? So you can't, you can't be too safe.

Anyway, Hey David, I want to thank you for coming up here and, and talking to us Sure. About this. Any, anytime.

Um, keep up the great work. You know what, you're an inspiration. As I mentioned, today's my birthday.

And as I look at, you know, what I want to be when at birthday, I grow up birthday. Yeah. Thank you.

When I look at what I wanna be, when I grow up, I'm not into retiring either, my friends. So You know what the perfect mix is? It's four hours a day, four days a week.

The problem with that is in business of any type, any, when it rains at four, You're in drop. It sucks in. Yeah, no, it sucks you in.

It's very, yeah. I can't do that. You know, I, this is my business here and I can't do it.

It's hard for me. Right. As I just get sucked in.

Anyway, keep up the great work. Have fun doing it, and we'll speak. Thank you in soon.

Always happy to hear about Florida Security success. All righty. All right.

Thank you. We're watching Textron Gang. We'll be back with more in just a moment.